CVE-2026-32255 | kanbn kan up to 0.5.4 Attachment Download Endpoint attatchment fetch server-side request forgery (GHSA-qrx8-9hc6-jvqg)

A vulnerability was found in kanbn kan up to 0.5.4. It has been classified as critical. The affected element is the function fetch of the file /api/download/attatchment of the component Attachment Download Endpoint. This manipulation causes server-side request forgery.

This vulnerability appears as CVE-2026-32255. The attack may be initiated remotely. There is no available exploit.

Upgrading the affected component is recommended.